Privacy Policy

1. Who this policy covers

DineNDash is operated by [FULL NAME], an individual in India, at [ADDRESS] (“we”). This policy explains how personal data is handled under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other Indian law.

There are two groups of people, and our role differs for each:

• Café owners and staff who sign up and use the console. For your account and billing data, we decide why and how it is used, so we are the data fiduciary.
• Café customers who scan a QR code and order. The café decides to collect your name, phone number and order. We process that data for the café to run the service, and we also act as a data fiduciary for the limited purposes below (security, fraud prevention and keeping the service running). The café you ordered from is the first place to ask about your order.

2. What we collect

Café owners and staff

• Name, email address and a password (stored only as a salted hash by our authentication provider).
• Café details: name, web address, menu, prices, photos, settings and staff list with roles.
• Billing details: plan, subscription status, invoices and payment references. Card, UPI and bank details are entered with Razorpay or Cashfree and are never stored by us.
• Payment gateway API keys you save to take online payments (Razorpay or Cashfree). They are stored encrypted, used only for your café’s payments, verification and refunds, never shared or sold, and deleted when you remove them. We also record when you gave consent and which user did.
• Technical data: sign-in sessions, IP address and device information in security and server logs, and records of admin actions.

Café customers

• Name and mobile number you give when ordering, and any note you add to an order.
• What you ordered, the amount, the token number and the time.
• A hashed (not readable) form of your network address, used to limit abuse.
• Payment status and a payment reference if you pay online. The payment itself is handled by Razorpay or Cashfree.
• If you tick the box at checkout, your mobile number is used to send your bill on WhatsApp.

3. Why we use it, and on what basis

We do not sell personal data, and we do not use customers’ names or numbers for marketing.

You can withdraw consent at any time (see your rights). Withdrawing does not affect what was done before, and some features may stop working without the data they need.

4. Who we share it with

We use these service providers (“processors”) to run the service. They handle data only to provide their service to us.

A café can see the orders, names and numbers of its own customers and no one else’s. We also disclose data where the law, a court or a government authority requires it.

5. How long we keep it

On request we erase data sooner, unless the law requires us to keep it.

6. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and who it has been shared with.
• Correct or complete data that is wrong or out of date.
• Erase your data, when it is no longer needed for the purpose it was collected or the law does not require us to keep it.
• Withdraw consent at any time.
• Grievance redressal, described below.
• Nominate another person to exercise these rights for you if you die or become unable to.

To use a right, email [EMAIL] from the address on your account (customers: include the mobile number and rough date of your order). We may need to confirm it is you. We aim to reply within 7 days and to complete the request within 30 days. Customers can also ask the café staff to erase their name and number before the 30 days are up.

7. Grievance contact

If you have a complaint about how your data is handled, write to [FULL NAME], [ADDRESS], or email [EMAIL]. We will acknowledge it within 48 hours and resolve it within 15 days.

If we do not resolve it, you may complain to the Data Protection Board of India once it is in operation, as provided in the DPDP Act.

8. Children

The console is for adults running a café; you must be 18 or older to sign up. We do not knowingly collect personal data of anyone under 18. If a parent or guardian believes a child has given us personal data, contact [EMAIL] and we will delete it.

9. Security

Data is encrypted in transit. Each café’s data is separated from other cafés at the database level, passwords are stored hashed, platform administrator access requires multi-factor sign-in, and payment card details never reach our servers. No system is perfectly secure. If a breach affecting your data occurs, we will tell you and the Data Protection Board as the law requires.

10. Where data is stored

Our providers may process data on servers outside India. We transfer data only to the providers listed above for the purposes in this policy, and not to any country the Government of India has restricted by notification.

11. Cookies

We use only the cookies needed to keep you signed in and to protect forms against abuse. We do not use advertising cookies.

12. Changes to this policy

We may update this policy. For material changes we will email account owners or show a notice before they apply. The date at the top shows the latest version.